CVE-2021-41987
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Mikrotik RouterOS devices by exploiting a heap-based buffer overflow in the SCEP Server component. Attackers need to know the scep_server_name value to trigger the overflow. This affects organizations using vulnerable Mikrotik RouterOS versions with SCEP Server enabled.
💻 Affected Systems
- Mikrotik RouterOS
📦 What is this software?
Routeros by Mikrotik
Routeros by Mikrotik
Routeros by Mikrotik
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root privileges, persistent backdoor installation, network traffic interception, and lateral movement to other systems.
Likely Case
Remote code execution leading to device takeover, credential theft, network disruption, and potential data exfiltration.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring, potentially only affecting isolated network segments.
🎯 Exploit Status
Exploit requires knowledge of scep_server_name value but no authentication. Public technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RouterOS versions after 6.47.10
Vendor Advisory: https://mikrotik.com/download/archive
Restart Required: Yes
Instructions:
1. Download latest RouterOS version from Mikrotik archive. 2. Backup current configuration. 3. Upload and install new firmware. 4. Reboot device. 5. Verify version update.
🔧 Temporary Workarounds
Disable SCEP Server
allDisable the vulnerable SCEP Server component if not required
/ip service disable scep
Network Segmentation
allRestrict access to SCEP Server port (default TCP 80/443) using firewall rules
/ip firewall filter add chain=input protocol=tcp dst-port=80,443 action=drop comment="Block SCEP access"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Deploy intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check RouterOS version and SCEP Server status: /system resource print and /ip service printCheck Version:
/system resource printVerify Fix Applied:
Verify RouterOS version is newer than 6.47.10 and SCEP Server is either disabled or patched📡 Detection & Monitoring
Log Indicators:
- Unusual SCEP Server activity
- Buffer overflow error messages in system logs
- Unexpected process creation
Network Indicators:
- Traffic to SCEP Server port with malformed requests
- Unusual outbound connections from RouterOS device
SIEM Query:
source="routeros" AND ("SCEP" OR "buffer overflow")